A flaw in the Linux kernel BPF verifier causes inconsistent register bounds tracking during speculative pointer arithmetic, leading to a REG INVARIANTS VIOLATION warning. The bug is triggered when an unprivileged user loads a carefully crafted BPF program that performs a pointer addition followed by data movement; the verifier snapshots the state mid‑execution, causing the bounds check to fail. The current description does not indicate that this results in memory corruption or privilege escalation, only that the verifier generates a warning and may reject the program.

The vulnerability affects the Linux kernel, specifically the BPF subsystem that verifies byte‑code programs. All kernel releases incorporating the BPF verifier before the patch that resolves the bounds‑tracking inconsistency are potentially impacted; exact version ranges are not specified in the advisory.

The CVSS score of 5.5 signifies moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. At present no publicly documented exploit exists; the primary impact is that an attacker can cause verification failures or denial of service of BPF programs by crafting a payload that exercise the specific verifier path. Achieving exploitation would require knowledge of the BPF byte‑code format and the ability to deliver a program that triggers the inconsistent state.